SBOM sharing has three phases: discovery (how the reader learns an SBOM exists), access (who is allowed to see it) and transport (how the file moves). CISA's primer rates each phase low, medium or high sophistication, and says that rating describes effort and tooling, not security maturity.
The three phases
The framework comes from a joint CISA and Department of Energy report of April 2023, and CISA's community working group built on it.
Discovery is the "mechanism used by the Consumer to know the SBOM exists and how to access it." Low sophistication means the consumer has to ask, with little guidance. Medium means the SBOM sits in a known place, such as a website or a repository. High means automated propagation, continuous updates and publish and subscribe patterns.
Access is the control the author or distributor uses to regulate who can view or use an SBOM. Low means no controls or manual, case by case ones. Medium means authentication and limited access control. High means delegated authentication and full access control granularity.
Transport is how the file is moved. Low means a human initiated, point to point process. Medium means a repeatable method such as an HTTPS download. High means documented, automated access using well-known protocols such as REST APIs.
Three roles, not two
The documents define three roles:
- SBOM author: creates the SBOM.
- SBOM consumer: receives it, which can include integrators and end users.
- SBOM distributor: receives SBOMs in order to share them with consumers or other distributors.
One organization can hold several roles at once. CISA notes these roles do not line up exactly with software producer, consumer and distributor, and that a producer may outsource SBOM generation to a third party who then becomes the author. See the SBOM distributor role explained.
Sophistication is not a grade
The primer is blunt about this: sophistication "does not imply maturity or preferability." Publishing a public SBOM for anyone to download may be low sophistication on discovery, yet be the right choice for an open source project. A regulated supplier may need high access control and accept more manual transport.
So do not score your program by how many "high" ratings it has. Match the choice to what you need.
Questions to ask about your own process
- How does a customer find out an SBOM exists for the product they use?
- Who is allowed to see it, and who decides?
- How do they receive it, and how long does that take?
- What happens when you release a new version, or correct an error?
- Can a consumer fetch it without emailing a person?
Write down the answers. Gaps in the list show where to improve. For a comparison of six real patterns, see SBOM sharing by email, portal or registry.
Scope of the primer
The primer covers sharing only. Quality, generation and use after receipt are outside its scope. For generation, see which SBOM type to ask for.
Quick check
Is high sophistication always better?
No. CISA says sophistication reflects effort and tooling, and the right level depends on priorities and context.
What is a distributor?
An organization that receives SBOMs to share with consumers or other distributors, without necessarily authoring or using them.
Sources
Last reviewed: 19 October 2026.
